CVE-2024-39930

The built-in SSH server of Gogs through 0.13.0 allows argument injection in internal/ssh/ssh.go, leading to remote code execution. Authenticated attackers can exploit this by opening an SSH connection and sending a malicious --split-string env request if the built-in SSH server is activated. Windows installations are unaffected.

CVSS v3.1 NVD

9.9 CRITICALCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CVSS v3.1 GitHub

9.9 CRITICALCVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:C/UI:N

EPSS

7.74% chance of exploitation in the next 30 days, 95th percentile

Published

2024-07-04

Updated

2024-08-28

Proof-of-concept exploits (3)

• https://www.vicarius.io/vsociety/posts/argument-injection-in-gogs-ssh-server-cve-2024-399…
• alexander47777/-CVE-2024-399300★ · 2025-07-22
• theMcSam/CVE-2024-39930-PoC0★ · 2025-07-01

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/52348

Security advisories

• https://www.sonarsource.com/blog/securing-developer-tools-unpatched-code-vulnerabilities-…
• advisories/GHSA-vm62-9jw3-c8w3
• gogs/gogs/releases

References

• CVE Record
• NVD entry

Related

• CVE-2016-10033
• CVE-2024-12905
• CVE-2024-42471